Vulnerabilities

TI-2026-05049 CVE-2026-5758 · GHSA-j452-xhg8-qg39

Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution

MEDIUM 62

JavaScript is vulnerable to prototype pollution in Mafintosh's protocol-buffers-schema Version 3.6.0, where an attacker may alter the application logic, bypass security checks, cause a DoS or achieve remote code executio…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00534 Published 2026-04-15 Partial fix · 3.6.1 CWE-1321

TI-2025-36904 CVE-2025-59343 · GHSA-vj76-c3g6-qr5v

tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball

LOW 38

tar-fs provides filesystem bindings for tar-stream.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0058 Published 2025-09-24 Partial fix · 3.1.1, 2.1.3 +3 CWE-22

TI-2025-30712 CVE-2025-48387 · GHSA-8cj5-5rvv-wf4v

tar-fs has issue where extract can write outside the specified dir with a specific tarball

MEDIUM 44

tar-fs provides filesystem bindings for tar-stream.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00579 Published 2025-06-02 Partial fix · 1.16.5, 2.1.3 +1 CWE-22

Vulnerabilities

Filters

Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution

tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball

tar-fs has issue where extract can write outside the specified dir with a specific tarball